You may have noticed the recent fuss about the compromise of event-stream, a popular NPM package: event-stream is a transitive dependency of many popular JavaScript projects including Vue, Angular, Gatsby and VSCode (some of them are using a version that isn’t affected by the attack). This attack raised, again, the problem of the JS dependency…